CVE-2026-116590

About vulnerability

Impact

Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, and therefore the typed-array write/read methods, pass caller-supplied ranges to this method.

Patches

Fixed in 1.1.10.9 (#741). Snappy.arrayCopy checks both ranges before copying. The stream read/write methods validate offsets and lengths, and reject typed-array ranges whose byte size overflows int.

Workarounds

Validate offsets and lengths before calling these methods.

Affected product:

Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Solr , Apache Spark , Elasticsearch , Hazelcast , Jackson , React , Spring , accumulo , activemq , agepredictor , alluxio , amazon-kinesis-client , amazon-kinesis-producer , apicurio-registry , arrow , artemis , astyanax , avro , aws-glue-schema-registry , bookkeeper , camel , canal , chronicle-engine , chronicle-map , crunch , curator , debezium , drill , dropwizard-metrics-hadoop-metrics2-reporter , druid , flink , flume , fuse-extra , glusterfs-hadoop , gora , hbase , ignite , incubator-retired-htrace , incubator-retired-slider , infinispan , java-lang , kite , logging-flume , logging-flume-irc , orc , org.apache.cassandra:cassandra-all , org.apache.parquet:parquet-cli , org.kitesdk:kite-data-hbase , org.tachyonproject:tachyon-client , parquet-java , pig , pravega , pulsar , rabbitmq-stream-java-client , schema-repo , servicemix-bundles , smallrye-mutiny-vertx-bindings , smallrye-reactive-messaging , snappy-java , tachyon , tika , tinkerpop , trino , twill , vertx-kafka-client , zipkin-reporter-java , zookeeper

Affected packages:

snappy-java @ 1.1.8.4 (+10529 more)